In January 2019, Paul Manafort’s lawyers filed a “redacted” memo with the court: sensitive passages were covered with black boxes. Copy-pasting the text was enough to read everything — including the sharing of polling data with a Russian intermediary. It was not an isolated blunder: redaction failure is a documented, measured phenomenon studied by security research. Here is what the research has established, and the method that answers it.
The first level of failure: a rectangle is a drawing, not a deletion
A PDF is not an image: text lives in a structured content stream, and the black rectangle is just a graphic object drawn on top. As long as the text object exists, any reader can recover it — select and copy-paste, extract with pdftotext, or let a search engine index it.
Famous failures number in the dozens. Besides the Manafort memo, there is the TSA screening manual published in 2009 with reversible black boxes, and the US military report on the death of Italian agent Nicola Calipari (2005), whose classified passages were recovered the same way. The defect does not spare professionals: as early as 2011, an analysis of about 2,000 documents from the US court system PACER counted nearly 200 reversible redactions.
Trodat ID Protector — privacy stampInk roller that masks addresses and identifiers on paper before disposal.affiliate
The second level: removing the text is not enough either
The natural conclusion — “just remove the text from the file” — is also insufficient. That is the subject of a research paper published in PoPETs in 2023, Story Beyond the Eye: Glyph Positions Break PDF Text Redaction (Maxwell Bland, Anushya Iyer, Kirill Levchenko, University of Illinois).
Their finding: even when the text under the box is genuinely removed from the file, the horizontal positions of the characters around the gap betray what was there. Justification, kerning and font metrics produce measurable sub-pixel shifts: comparing them with the expected positions for each candidate word can narrow the space of possibilities dramatically — sometimes down to the censored word itself.
The measured results speak for themselves:
- 11 popular redaction tools examined, including Adobe Acrobat workflows: the majority leak information;
- some redactions lose more than 15 bits of entropy — the space of candidate texts shrinks by a factor of roughly 32,000;
- on a real-world corpus of 22,120 documents (including 18,975 US Office of Inspector General reports), 769 named-entity redactions prove vulnerable; for 164 of them, the authors reduce the name to fewer than 494 candidates from a 7-million-name dictionary;
- the researchers demonstrate the attack on filings from the Epstein/Maxwell and Manafort cases and on a released Snowden document, and spot more than 100,000 poorly redacted documents in the wild.
The authors released open-source corrective algorithms and notified Adobe, Microsoft, the US Department of Justice and PACER. The lesson: a redaction that keeps the page’s text objects — even cleaned ones — remains attackable.
The third channel: everything that lingers around the text
Even a correctly executed redaction can leak at the edges. Document title and author, creation and modification dates, the XMP metadata stream, annotations, attachments, layers and thumbnails all survive a redaction that does not rebuild the file. A page’s anonymity can collapse because the “Author” field says who produced it.
The correct answer: destroy the page, not the word
The method that closes all three channels is destructive rasterization: rendering the page as an image. In an image there is no text object to extract, no glyph positions to measure, no stream to dissect. What used to be text becomes pixels — and under the rectangle, black pixels.
That is exactly the method applied by Document Flare’s redaction tool, and it is verifiable in the code: after drawing the opaque rectangles, each censored page is rendered to a canvas (2x scale), converted to JPEG (0.95 quality) and reinserted into a PDF rebuilt from scratch. Pages without redactions are copied as-is. And because the output is a brand-new file, no source metadata is carried over — no title, no author, no original dates; only the Producer/Creator “Document Flare” fields are written.
The scan that finds the areas to redact also runs in the browser: nine types of personal data detected (IBAN, French social security numbers, bank cards, SIREN and SIRET, emails, phone numbers, birth dates, IPv4 addresses), plus a keyword mode for names and references the detector does not know. The full step-by-step is in our article on redacting personal data in a PDF.
Honest limits
Rasterization is the right method, not a free one:
- redacted pages become images: text is no longer selectable, links and bookmarks on those pages disappear, and the file can grow heavier;
- only pages containing a redacted area are rasterized — the others keep their text;
- automatic detection remains heuristic: an exotic identifier, a name without context or a scan with no text layer can escape it. Proofread and complete with keywords;
- redaction covers visible content; for annotations or attachments, chain it with the cleanup tool (see clean a PDF before sharing).
The final test is the same as for any tool: reopen the produced PDF and try to copy what lies under a black box. Nothing should come out. And since everything runs in your browser, you can also check in the Network tab that no request carried the document — the protocol is detailed in our local processing guide and in the pillar on PDF tools without upload.
The right hardware
Trodat ID Protector — privacy stampInk roller that masks addresses and identifiers on paper before disposal.affiliate
Fellowes 6M — P-4 micro-cutP-4 micro-cut: right for ID documents and financial papers.affiliate
